US8392499B2 - System and method for relating aborted client accesses of data to quality of service provided by a server in a client-server network - Google Patents
System and method for relating aborted client accesses of data to quality of service provided by a server in a client-server network Download PDFInfo
- Publication number
- US8392499B2 US8392499B2 US10/146,988 US14698802A US8392499B2 US 8392499 B2 US8392499 B2 US 8392499B2 US 14698802 A US14698802 A US 14698802A US 8392499 B2 US8392499 B2 US 8392499B2
- Authority
- US
- United States
- Prior art keywords
- server
- aborted
- client
- given
- accesses
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related, expires
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
Definitions
- the present invention relates in general to client-server networks, and more specifically to a system and method for relating aborted client accesses of data to the client-perceived quality of service provided by a server.
- content providers sometimes referred to as “content providers”
- aborted client accesses of a service may be indicative of the client-perceived quality of such service. For instance, if a client requests to access a service provided by a service provider and it takes several minutes for the service to be downloaded from the service provider to the client, the client may consider the quality of the service as being poor because of its long download time. In fact, the client may be too impatient to wait for the service to fully load and may therefore abort the client's access thereof. For example, the client may cause his/her network connection to the service provider to be aborted (and may attempt to obtain the service from another provider).
- the Internet is a popular client-server network in which a service provider may desire information about its client-perceived quality of service (QoS).
- QoS quality of service
- the Internet is a packet-switched network, which means that when information is sent across the Internet from one computer to another, the data is broken into small packets.
- a series of switches called routers send each packet across the network individually. After all of the packets arrive at the receiving computer, they are recombined into their original, unified form.
- TCP/IP is a protocol commonly used for communicating the packets of data.
- TCP/IP In TCP/IP, two protocols do the work of breaking the data into packets, routing the packets across the Internet, and then recombining them on the other end: 1) the Internet Protocol (IP), which routes the data, and 2) the Transmission Control Protocol (TCP), which breaks the data into packets and recombines them on the computer that receives the information.
- IP Internet Protocol
- TCP Transmission Control Protocol
- World Wide Web which may be referred to herein simply as the “web”.
- Computers or “servers”) that provide information on the web are typically called “websites.” Services offered by service providers' websites are obtained by clients via the web by downloading web pages from such websites to a browser executing on the client.
- a user may use a computer (e.g., personal computer, laptop computer, workstation, personal digital assistant, cellular telephone, or other processor-based device capable of accessing the Internet) to access the Internet (e.g., via a conventional modem, cable modem, Digital Subscriber Line (DSL) connection, or the like).
- a browser such as NETSCAPE NAVIGATOR® developed by NETSCAPE, INC.
- MICROSOFT INTERNET EXPLORER® developed by MICROSOFT CORPORATION
- a web page is typically composed of a mark-up language file, such as a HyperText Mark-up Language (HTML), Extensible Mark-up Language (XML), Handheld Device Mark-up Language (HDML), or Wireless Mark-up Language (WML) file, and several embedded objects, such as images.
- HTML HyperText Mark-up Language
- XML Extensible Mark-up Language
- HDML Handheld Device Mark-up Language
- WML Wireless Mark-up Language
- a browser retrieves a web page by issuing a series of HyperText Transfer Protocol (HTTP) requests for all objects.
- HTTP HyperText Transfer Protocol
- HTTP is the underlying protocol used by the World Wide Web.
- the HTTP requests can be sent through one persistent TCP connection or multiple concurrent connections.
- web page is generally a complex object having multiple embedded objects (e.g., images and/or JAVASCRIPTs, etc.) each of which the client's browser retrieves separately.
- One way to measure the QoS of a web server is to measure the amount of aborted client accesses of web pages provided by the web server. For example, the number of aborted client accesses with a web server may provide an indication of the web server's QoS. The logic behind this is that if a web site is not fast enough a user will get impatient and hit the stop button of his/her browser, thus aborting the client's access thereof.
- detection of aborted client accesses of a web page may provide some indication regarding the client-perceived QoS of a website.
- interpreting all aborted client accesses of a web page as being indicative of poor server QoS is problematic.
- User actions at the browser level can effectively interrupt the request/response exchange for fetching page objects at any time. These interrupting actions include, as examples, clicking the browser “stop” or “reload” buttons while a page is loading. As an example of a further interrupting action, a user may “quick click” on a hyperlink displayed before the page loads completely.
- aborted client accesses of a web page are indicative of poor QoS.
- a user may interrupt a page load for reasons other than the client perceiving the QoS as poor for the page.
- the user may be familiar with the page that is loading and may quick click on a hyperlink (i.e., before the page fully loads) to efficiently navigate through the page, or the user may simply change his/her mind about retrieving the page for reasons other than poor QoS.
- only a subset of aborted client accesses of a web page may be relevant to a poor website QoS or poor network performance, while the other portion of aborted accesses may be relevant to client-specific browsing patterns.
- a method for relating aborted client accesses of server information to the quality of service provided to clients by a server in a client-server network.
- the method comprises determining performance data for at least one aborted client access of information from a server in a client-server network, and using the performance data to determine whether the aborted client access(es) relate to the quality of service provided to a client by the server.
- FIG. 1 shows an example client-server system in which embodiments of the present invention may be implemented
- FIG. 2 shows an example of interrupting actions that may be initiated at a browser executing on a client to abort the client's access of data on a server;
- FIG. 3 shows an example operational flow diagram of a preferred embodiment of the present invention
- FIG. 4 shows a block diagram of an example implementation for reconstructing client web page accesses from transactions and using performance data to relate the aborted client accesses of information on a server to the server's QoS in accordance with one embodiment of the present invention
- FIG. 5 shows an example operational flow for determining performance data for an aborted client access of information on a server and using such performance data to determine whether the aborted client access is related to poor server QoS in accordance with a preferred embodiment of the present invention
- FIG. 6 shows the number of all requests and the number of aborted requests to the “index.html” page over time for a study conducted with a preferred embodiment of the present invention
- FIG. 7 shows the average end-to-end response time observed by the clients when downloading the “index.html” page and the average end-to-end response time observed by the clients of the aborted accesses to the “index.html” page for a study conducted with a preferred embodiment of the present invention
- FIG. 8 shows cumulative distribution of all accesses to “index.html” and aborted accesses to “index.html” sorted by their end-to-end response time in increasing order for a study conducted with a preferred embodiment of the present invention.
- FIG. 9 shows an example computer system on which embodiments of the present invention may be implemented.
- service providers in a client-server network e.g., website providers
- An indication of the client-perceived QoS may be obtained by evaluating the number of aborted client accesses of data (or “information”) on a server. For example, if a website does not download a requested web page fast enough to a client, the user may get impatient and hit the stop button of his/her browser, thus aborting the client's access of such web page.
- an aborted access comprises an aborted connection(s) (e.g., aborted network connection(s)) with the server.
- a client aborted access of a web page may comprise aborting the client's network connection(s) (e.g., TCP connection(s)) with the web server.
- interpreting all aborted client accesses of data (e.g., web page) on a server as being indicative of poor server QoS is problematic because not all aborted client accesses are truly indicative of a server's QoS.
- a user may interrupt a web page load for reasons other than the client perceiving the page's QoS as poor.
- the user may be familiar with the page loading and may quick click on a hyperlink (i.e., before the page fully loads) to efficiently navigate through the page, or the user may simply change his/her mind about retrieving the page for reasons other than poor QoS.
- aborted client accesses of web pages may be relevant to poor website QoS or poor network performance, while the other portion of aborted web page accesses may be relevant to client-specific browsing patterns. Accordingly, a desire exists for a technique that enables determination of whether aborted client accesses of data (e.g., a web page) on a server are truly indicative of the server's QoS.
- data e.g., a web page
- embodiments of the present invention use performance data to determine whether an aborted client access of server information (e.g., a web page) is indicative of poor QoS. For example, it may be determined whether the server's response time exceeded a defined threshold amount in serving up a requested web page in order to determine whether the page access was likely aborted because of poor QoS. For instance, if the server's response time in serving up a requested web page exceeds a defined threshold time, then it may be determined that the aborted client access of such page is indicative of client-perceived poor QoS provided by the server.
- server information e.g., a web page
- the client accesses having a high response time from the server i.e., the overall time observed by the client to retrieve the page and its embedded objects
- those aborted client accesses having a high response time may be identified as being indicative of client-perceived poor QoS.
- certain embodiments of the present invention utilize performance data for a client's access of server information (e.g., web page) to determine latency that is attributable to server-related performance issues and latency that is attributable to network-related performance issues. That is, for those client accesses of server information that are determined to have a high response time, two basic reasons leading to the poor performance may be determined: 1) server-related performance issues (e.g., high web server processing time for a web page due, for example, to server overload), and 2) network-related performance issues (e.g., high network transfer time for a web page due, for example, to network congestion and/or low bandwidth available to a client).
- server-related performance issues e.g., high web server processing time for a web page due, for example, to server overload
- network-related performance issues e.g., high network transfer time for a web page due, for example, to network congestion and/or low bandwidth available to a client.
- an aborted client access of server information may be determined whether an aborted client access of server information had a high response time that is attributable to the server's performance, as opposed to the network's performance, from which a determination may be made as to whether such aborted access is indicative of poor QoS provided by the server.
- certain embodiments of the present invention are operable to distinguish whether the performance reasons (e.g., server overload or poor network latency) lead to the aborted client accesses of server information, or whether the aborted accesses are unrelated to the server's QoS but instead reflect client-specific browsing patterns.
- FIG. 1 an example client-server system 100 is shown in which embodiments of the present invention may be implemented.
- one or more servers 101 A- 101 D may provide services (information) to one or more clients, such as clients A-C (labeled 104 A- 104 C, respectively), via communication network 103 .
- Communication network 103 is preferably a packet-switched network, and in various implementations may comprise, as examples, the Internet or other Wide Area Network (WAN), an Intranet, Local Area Network (LAN), wireless network, Public (or private) Switched Telephony Network (PSTN), a combination of the above, or any other communications network now known or later developed within the networking arts that permits two or more computers to communicate with each other.
- WAN Wide Area Network
- LAN Local Area Network
- PSTN Public (or private) Switched Telephony Network
- servers 101 A- 101 D comprise web servers that are utilized to serve up web pages to clients A-C via communication network 103 in a manner as is well known in the art. Accordingly, system 100 of FIG. 1 illustrates an example of servers 101 A- 101 D serving up web pages, such as web page 102 , to requesting clients A-C.
- embodiments of the present invention are not limited in application to relating aborted client accesses of web pages to web server QoS, but may instead be implemented for relating aborted client accesses of other types of information provided by a server to the server's QoS.
- web page 102 comprises an HTML (or other mark-up language) file 102 A (which may be referred to herein as a “main page”), and several embedded objects (e.g., images, etc.), such as Object 1 and Object 2 .
- HTML or other mark-up language
- Object 1 and Object 2 embedded objects
- Techniques for serving up such web page 102 to requesting clients A-C are well known in the art, and therefore such techniques are only briefly described herein.
- a browser such as browsers 105 A- 105 C, may be executing at a client computer, such as clients A-C. To retrieve a desired web page 102 , the browser issues a series of HTTP requests for all objects of the desired web page.
- requests/responses 106 A- 106 F are communicated between client A and server 101 A in serving web page 102 to client A, such as requests/responses 106 A- 106 F (referred to collectively herein as requests/responses 106 ).
- Requests/responses 106 provide a simplified example of the type of interaction typically involved in serving a desired web page 102 from server 101 A to client A.
- requests/responses 106 do not illustrate all interaction that is involved through TCP/IP communication for serving a web page to a client, but rather provides an illustrative example of the general interaction between client A and server 101 A in providing web page 102 to client A.
- the browser When a client clicks a hypertext link (or otherwise requests a URL) to retrieve a particular web page, the browser first establishes a TCP connection with the web server by sending a SYN packet (not shown in FIG. 1 ). If the server is ready to process the request, it accepts the connection by sending back a second SYN packet (not shown in FIG. 1 ) acknowledging the client's SYN. At this point, the client is ready to send HTTP requests 106 to retrieve the HTML file 102 A and all embedded objects (e.g., Object 1 and Object 2 ), as described below.
- client A makes an HTTP request 106 A to server 101 A for web page 102 (e.g., via client A's browser 105 A). Such request may be in response to a user inputting the URL for web page 102 or in response to a user clicking on a hyperlink to web page 102 , as examples.
- Server 101 A receives the HTTP request 106 A and sends HTML file 102 A (e.g., file “index.html”) of web page 102 to client A via response 106 B.
- HTML file 102 A typically identifies the various objects embedded in web page 102 , such as Object 1 and Object 2 . Accordingly, upon receiving HTML file 102 A, browser 105 A requests the identified objects, Object 1 and Object 2 , via requests 106 C and 106 E.
- server 101 A Upon server 101 A receiving the requests for such objects, it communicates each object individually to client A via responses 106 D and 106 F, respectively. As illustrated by the generic example of FIG. 1 , each object of a requested web page is retrieved from a server by an individual HTTP request made by the client.
- a client request and corresponding server response e.g., HTTP request-response pair
- a transaction e.g., an HTTP transaction
- each object of a web page is requested individually by the requesting client and is, in turn, communicated individually from the server to the requesting client.
- the above requests/responses 106 may each comprise multiple packets of data.
- the HTTP requests can, in certain implementations, be sent from a client through one persistent TCP connection with server 101 A, or, in other implementations, the requests may be sent through multiple concurrent connections.
- Server 101 A may also be accessed by other clients, such as clients B and C of FIG. 1 , and various web page objects may be communicated in a similar manner to those clients through packet communication 107 and 108 , respectively.
- One way to measure the QoS of a web server is to measure the number of aborted client accesses of web pages provided by the web server.
- various user actions at the browser level can effectively interrupt the request/response exchange for fetching page objects at any time. For instance, suppose client A ( 104 A) is interacting with server 101 A of “Company A” via transactions 106 over communication network 103 to receive a web page (e.g., web page 102 of FIG. 1 ) having a URL “www.CompanyA.com”.
- a user of browser 105 A executing on client A may take some action to interrupt the page loading.
- a user may activate “stop” button 201 (e.g., by clicking such stop button 201 with a pointing device, such as a mouse or trackball), which aborts the client's access of the web page that is loading.
- stop button 201 e.g., by clicking such stop button 201 with a pointing device, such as a mouse or trackball
- certain aborted accesses include aborting the client's network connection with the web server.
- stop button 201 generally results in aborting the client's TCP connection with web server 101 A.
- a user may activate “refresh” button 202 while the requested page is loading, causing the TCP connection with web server 101 A to be aborted and a new connection established to reload the page.
- a user may “quick click” on a hyperlink, such as hyperlink 203 , that is displayed before the requested page loads completely, thus causing the client's TCP connection for the originally requested page “www.CompanyA.com” to be aborted.
- aborted client accesses of a web page are indicative of poor QoS.
- a user may interrupt a page load for reasons other than the client perceiving the QoS being poor for the page.
- the user may be familiar with the page loading and may quick click on a hyperlink (i.e., before the page fully loads) to efficiently navigate through the page, or the user may simply change his/her mind about retrieving the page for reasons other than poor QoS.
- a subset of aborted client web page accesses may be relevant to poor website QoS or poor network performance, while the other portion of aborted accesses may be relevant to client-specific browsing patterns.
- Various embodiments of the present invention relate aborted client accesses of server information (e.g., web page) to the server's QoS. That is, embodiments of the present invention enable a determination of whether an aborted client access of server information is indicative of poor server QoS. More specifically, embodiments of the present invention utilize performance data for an aborted client access of server information (e.g., web page) to determine whether such aborted access is likely related to poor server QoS.
- server information e.g., web page
- client-server transactions are acquired.
- information relating to client-server transactions such as transactions 106 of FIG. 1
- a Transaction Log is generated that comprises collected information relating to client-server transactions.
- a client access of a server e.g., a client web page access
- a client access of a web page may comprise a plurality of separate transactions.
- a Web Page Session Log is generated that comprises collected information for transactions organized by the web page access to which the transactions correspond.
- operation advances to block 304 for at least such one or more aborted accesses.
- performance data such as server response time
- the determined performance data is used to determine whether each of the aborted accesses is attributable to poor server QoS. For instance, if the performance data for a given aborted web page access indicates that the server's response time was above a defined threshold, then it may be concluded in block 305 that the given aborted web page access is likely attributable to poor server QoS.
- FIG. 4 shows a block diagram of an example implementation for reconstructing client web page accesses from transactions and using performance data to relate the aborted web page accesses to server QoS in accordance with one embodiment of the present invention.
- this example embodiment comprises network packets collector module 401 , request-response reconstructor module 402 (which may be referred to herein as transaction reconstructor module 402 ), and web page access reconstructor module 403 .
- performance analysis module 404 is included for performing performance analysis (e.g., measuring client-perceived end-to-end performance) for aborted web page accesses to relate such aborted accesses to server QoS.
- network packets collector module 401 is operable to collect network-level information that is utilized to reconstruct web page accesses. More specifically, in this example embodiment, network packets collector module 401 utilizes a tool to capture network packets, such as the publicly available UNIX tool known as “tcpdump” or the publicly available WINDOWS tool known as “WinDump.”
- the software tools “tcpdump” and “WinDump” are well-known and are commonly used in the networking arts for capturing network-level information for network “sniffer/analyzer” applications. Typically, such tools are used to capture network-level information for monitoring security on a computer network (e.g., to detect unauthorized intruders, or “hackers”, in a system).
- other tools now known or later developed for capturing network-level information, or at least the network-level information utilized by embodiments of the present invention may be utilized in alternative embodiments of the present invention.
- Network packets collector module 401 records the captured network-level information (e.g., network packets) to a Network Trace file 401 A.
- This approach allows the Network Trace 401 A to be processed in offline mode.
- tcpdump may be utilized to capture many packets (e.g., a million packets) for a given period of time (e.g., over the course of a day), which may be compiled in the Network Trace 401 A. Thereafter, such collected packets in the Network Trace 401 A may be utilized by request-response reconstructor module 402 in the manner described further below.
- While this example embodiment utilizes a tool, such as tcpdump, to collect network information for offline processing, known programming techniques may be used, in alternative embodiments, to implement a real-time network collection tool. If such a real-time network collection tool is implemented in network packets collector module 401 , the various other modules of FIG. 4 may be similarly implemented to use the real-time captured network information to reconstruct web page accesses (e.g., in an on-line mode of operation).
- a tool such as tcpdump
- request-response reconstructor module 402 reconstructs all TCP connections and extracts HTTP transactions (e.g., a request with the corresponding response) from the payload of the reconstructed TCP connections. More specifically, in one embodiment, request-response reconstructor module 402 rebuilds the TCP connections from the Network Trace 401 A using the client IP addresses, client port numbers and the request (response) TCP sequence numbers. Within the payload of the rebuilt TCP connections, the HTTP transactions may be delimited as defined by the HTTP protocol. Meanwhile, the timestamps, sequence numbers and acknowledged sequence numbers may be recorded for the corresponding beginning or end of HTTP transactions.
- request-response reconstructor module 402 may extract HTTP header lines from the transactions.
- the HTTP header lines are preferably extracted from the transactions because the payload does not contain any additional useful information for reconstructing web page accesses, but the payload requires approximately two orders of magnitude of additional storage space.
- the resulting outcome of extracting the HTTP header lines from the transactions is recorded to a Transaction Log 402 A, which is described further below. That is, after obtaining the HTTP transactions, request-response reconstructor module 402 stores some HTTP header lines and other related information from Network Trace 401 A in Transaction Log 402 A for future processing (preferably excluding the redundant HTTP payload in order to minimize storage requirements).
- request-response reconstructor module 402 uses such methodology for rebuilding HTTP transactions from TCP-level traces.
- Transaction Log 402 A may be generated in a kernel-level module implemented on the server as described in greater detail in U.S. patent application Ser. No. 10/147,249, now U.S. Pat. No. 7,437,451 titled “SYSTEM AND METHOD FOR COLLECTING DESIRED INFORMATION FOR NETWORK TRANSACTIONS AT THE KERNEL LEVEL,” the disclosure of which is hereby incorporated herein by reference.
- Such alternative embodiment may be desired because, for example, it enables information for transactions to be collected at the kernel level of a server (e.g., a web server), which may avoid rebuilding the transactions at the user level as in the methodology proposed by Anja Feldmann.
- Such alternative embodiment may enable greater computing efficiency in generating Transaction Log 402 A because the transactions are not required to be reconstructed at the user level, and/or it may require less storage space because only the desired information for transactions may be communicated from the kernel level to the user level as opposed to the raw network information of Network Trace 401 A being stored at the user level (which may include much more information than is desired for each transaction), as described further in the above-referenced U.S. Patent Application “SYSTEM AND METHOD FOR COLLECTING DESIRED INFORMATION FOR NETWORK TRANSACTIONS AT THE KERNEL LEVEL.”
- Transaction Log 402 A is generated (e.g., either from Network Trace 401 A or from a kernel level module), the transactions thereof may be related to their corresponding client web page access.
- a web page is generally composed of one HTML file and some embedded objects, such as images or JAVASCRIPTS.
- the client's browser should retrieve all the page-embedded images from a web server in order to display the requested page. The client browser retrieves each of these embedded images separately.
- each object of a requested web page is retrieved from a server by an individual HTTP request made by the client.
- An HTTP request-response pair may be referred to collectively herein as an HTTP “transaction.”
- Entries of Transaction Log 402 A contain information about these individual HTTP transactions (i.e., requests/responses).
- the next step in reconstructing a web page access is to relate the different individual HTTP transactions in the sessions corresponding to a particular web page access. That is, the various different HTTP transactions collected in Transaction Log 402 A are related together as logical web pages.
- web page access reconstructor module 403 is responsible for grouping the underlying physical object retrievals together into logical web pages, and stores them in Web Page Session Log 403 A. More specifically, web page access reconstructor module 403 analyzes Transaction Log 402 A and groups the various different HTTP transactions that correspond to a common web page access.
- Web Page Session Log 403 A comprises the HTTP transactions organized (or grouped) into logical web page accesses.
- web page reconstructor module 403 is described in greater detail in U.S. patent application Ser. No. 10/147,256, now U.S. Pat. No. 7,487,508 entitled “SYSTEM AND METHOD FOR RECONSTRUCTING CLIENT WEB PAGE ACCESSES FROM CAPTURED NETWORK PACKETS” and in U.S. patent application Ser. No. 10/147,619 now U.S. Pat. No. 7,246,101 entitled “KNOWLEDGE-BASED SYSTEM AND METHOD FOR RECONSTRUCTING CLIENT WEB PAGE ACCESSES FROM CAPTURED NETWORK PACKETS”, the disclosures of which are incorporated herein by reference.
- performance analysis module 404 may be utilized in accordance with various embodiments of the present invention to relate the aborted client web page accesses to server QoS. For instance, performance analysis module 404 may, for each web page access of Web Page Session Log 403 A, determine whether any transactions in such web page access were aborted. If the web page access includes aborted transaction(s), then such web page access is considered to be aborted. If the client's web page access was aborted, performance analysis module 404 may evaluate the response time for serving up the web page to the client that was encountered before the access was aborted.
- the client-perceived end-to-end response time for a web page download before such web page download was aborted may be measured. If the response time is determined to be greater than a defined threshold, then it may be determined that the aborted client access of such web page is indicative of poor server QoS, as opposed, for example, to a client-specific browsing pattern.
- Transaction Log 401 A information acquired for client-server transactions (in Transaction Log 401 A) may be used to relate aborted client web page accesses to server QoS. While Transaction Log 401 A may comprise any desired network information in various implementations of alternative embodiments, Table 1 below describes in greater detail the format of an entry in HTTP Transaction Log 401 A of a preferred embodiment of the present invention.
- TABLE 1 Field Value URL The URL of the transaction. Referer The value of the header field Referer, if it exists.
- Content Type The value of the header field Content-Type in the responses.
- Flow ID A unique identifier to specify the TCP connection of this transaction.
- Source IP The client's IP address.
- Request Length The number of bytes of the HTTP request.
- Response Length The number of bytes of the HTTP response.
- Content Length The number of bytes of HTTP response body.
- Request SYN timestamp The timestamp of the SYN packet from the client.
- Request Start timestamp The timestamp for receipt of the first byte of the HTTP request.
- Request End timestamp The timestamp for receipt of the last byte of the HTTP request.
- Start of Response The timestamp when the first byte of response is sent by the server to the client End of Response
- the time stamp when the last byte of response is sent by the server to the client ACK of Response The ACK packet from the client for the last Timestamp byte of the HTTP response.
- Response Status The HTTP response status code. Via Field Identification of whether the HTTP field Via is set. Aborted Identification of whether the TCP connection aborted.
- Resent Request Packets The number of packets resent by the client.
- Resent Response Packet The number of packets resent by the server.
- the first field provided in the example Transaction Log entry of Table 1 is the URL field, which stores the URL for the HTTP transaction (e.g., the URL for the object being communicated to the client in such transaction).
- the next field in the entry is the Referer field.
- an HTML file 102 A is first sent to the client, such as a file “index.html”, which identifies the object(s) to be retrieved for the web page, such as Object 1 and Object 2 in the example of FIG. 1 .
- the objects for the requested web page e.g., Object 1 and Object 2
- HTTP transactions in the manner described above with FIG.
- the Referer field identifies that those objects are embedded in (or are part of) the requested web page (e.g., the objects are associated with the index.html file in the above example). Accordingly, when transactions for downloading various different objects have the same Referer field, such objects belong to a common web page.
- the HTTP protocol defines such a Referer field, and therefore, the Referer field for a transaction may be taken directly from the captured Network Trace information for such transaction. More specifically, in the HTTP protocol, the referer request-header field allows the client to specify, for the server's benefit, the address (URI) of the resource from which the Request-URI was obtained (i.e., the “referrer”, although the header field is misspelled).
- URI address
- the referer request-header allows a server to generate lists of back-links to resources for interest, logging, optimized caching, etc.
- the Referer field of a transaction directly identifies the web page to which the object of such transaction corresponds.
- the next field provided in the example entry of Table 1 is the Content Type field, which identifies the type of content downloaded in the transaction, such as “text/html” or “image/jpeg”, as examples.
- the next field in the entry is Flow ID, which is a unique identifier to specify the TCP connection of this transaction.
- the next field in the entry is Source IP, which identifies the IP address of a client to which information is being downloaded in the transaction.
- the next field in the example entry of Table 1 is the Request Length field, which identifies the number of bytes of the HTTP request of the transaction.
- the Response Length field is included in the entry, which identifies the number of bytes of the HTTP response of the transaction.
- the Content Length field is also included, which identifies the number of bytes of the body of the HTTP response (e.g., the number of bytes of an object being downloaded to a client).
- the next field in the example entry of Table 1 is the Request SYN timestamp, which is the timestamp of the SYN packet from the client.
- the browser first establishes a TCP connection with the web server by sending a SYN packet. If the server is ready to process the request, it accepts the connection by sending back a second SYN packet acknowledging the client's SYN. Only after this connection is established can the true request for a web page be sent to the server. Accordingly, the Request SYN timestamp identifies when the first attempt to establish a connection occurred. This field may be used, for example, in determining the latency breakdown for a web page access to evaluate how long it took for the client to establish the connection with the server.
- the next field in the entry is the Request Start timestamp, which is the timestamp for receipt of the first byte of the HTTP request of the transaction. Accordingly, this is the timestamp for the first byte of the HTTP request that is received once the TCP connection has been established with the server.
- the Request End timestamp is also included as a field in the entry, which is the timestamp for receipt of the last byte of the HTTP request of the transaction.
- the next field in the entry is the Start of Response field, which identifies the timestamp when the first byte of the response is sent by the server to the client.
- the entry next includes an End of Response field, which identifies the timestamp when the last byte of the response is sent by the server to the client.
- the next field in the entry is ACK of Response timestamp, which is the timestamp of the ACK packet (acknowledge packet) from the client for the last byte of the HTTP response of the transaction.
- the Request Start timestamp, Request End timestamp, and ACK of Response timestamp fields may be used (e.g., by performance analysis module 403 ) in measuring the end-to-end performance perceived by the client for a web page access in certain implementations.
- the next field in the example entry of Table 1 is the Response Status field, which is the HTTP response status code.
- the response status code may be a “successful” indication (e.g., status code “200” in HTTP) or an “error” indication (e.g., status code “404” in HTTP).
- the web server upon receiving a client's request for a web page (or object embedded therein), the web server provides a successful response (having status code “200”), which indicates that the web server has the requested file and is downloading it to the client, as requested. However, if the web server cannot find the requested file, it may generate an error response (having status code “404”), which indicates that the web server does not have the requested file.
- the next field in the example entry of Table 1 is the Via field, which is typically set by a proxy of a client. If the client request is received by the server from a proxy, then typically proxies add their request field in the Via field. Thus, the Via field indicates that in fact its not the original client who requested this file, or who is making this request, but rather it is the proxy acting on behalf of the client.
- the next field in the example entry of Table 1 is the Aborted field, which indicates whether the current transaction was aborted.
- the Aborted field may indicate whether the client's TCP connection for such transaction was aborted.
- various techniques may be used to detect whether the client's TCP connection with the server and the current transaction, in particular, is aborted.
- the next field in the entry is the Resent Request Packets field, which provides the number of packets resent by the client in the transaction.
- the Resent Response Packet field is the final field in the entry, which provides the number of packets resent by the server in the transaction.
- some fields of the HTTP Transaction Log entry may be used to rebuild web pages (e.g., via web page access reconstructor module 402 ), such as the URL, Referer, Content Type, Flow ID, Source IP, Request Start timestamp, and Response End timestamp fields. Examples of reconstructing web page accesses in this manner are further described in U.S. patent application Ser. No. 10/147,256, now U.S. Pat. No. 7,487,508 entitled “SYSTEM AND METHOD FOR RECONSTRUCTING CLIENT WEB PAGE ACCESSES FROM CAPTURED NETWORK PACKETS” and U.S. patent application Ser. No. 10/147,619, now U.S. Pat. No.
- the first request is for the HTML file index.html.
- the content-type field in the corresponding response shows that it is an HTML file (i.e., content type of “text/html”).
- the next request is for the embedded image imgl.jpg.
- the request header field referer indicates that the image is embedded in index.html.
- the corresponding response shows that the content type for this second transaction is an image in jpeg format (i.e., content type of “image/jpeg”). It should be noted that both of the transactions above have a status “200” (or “OK”) returned, which indicates that they were successful.
- a client web page access is considered to be aborted if at least one of the transactions comprising the client access is aborted.
- a client web page access is considered to be aborted if one of the TCP connections used to retrieve an object of the page is aborted.
- such aborted access is indicated in the corresponding transaction entry of Transaction Log 402 A (e.g., in the Aborted field of the example transaction entry of Table 1 described above). Detection of aborted web page accesses can be performed in at least three different ways: 1) in software implemented on the client (e.g., in the client's browser), 2) in software implemented on the server, or 3) from the server-side logs.
- the first approach for detecting aborted web page accesses involves modifications or annotation of the software executing on the clients, and considering the installed base of more than 100 million web browsers, such an implementation may require a significant number of updates to be made.
- the second approach is supported by some web servers and has been used in a study by Arlitt et al. See M. Arlitt and C. Williamson, “Web server workload characterization: the search for invariants” in Proceedings of the ACM SIGMETRICS '96 Conference, Philadelphia, Pa., May 1996, the disclosure of which is hereby incorporated herein by reference.
- One drawback with this approach is that it is not supported on all web servers, such as APACHE, NETSCAPE LITE, and others.
- the third approach extracts this information from the web access logs generated at the web server by 1) first estimating the real size of the document; and 2) if the number of transferred bytes is less than the real size it can either be that the document got modified or that the client actually aborted the access thereof. See L. Cherkasova and M. Karlsson, “Dynamics and Evolution of Web Sites: Analysis, Metrics and Design Issues”, Proceedings of the Sixth International Symposium on Computers and Communications (ISCC '01), Hammamet, Tunisia, Jul.
- aborted client accesses of server information are detected using network packet level information collected on the web server side of the client-server network. More specifically, a preferred embodiment uses two basic observations available from the TCP/IP packets to detect aborted web page accesses: 1) a RST packet sent by the HTTP client to a sever that explicitly indicates the aborted connection, and 2) a FIN packet with ACK sent by an HTTP client to a server where the acknowledged sequence number is less than the observed maximum sequence number sent from the server. If either of the above situations are detected for a TCP connection, then it is determined that the client's TCP connection with the server (and the current transaction, in particular) was aborted by the client.
- server information e.g., web page
- RST packet stands for “connection reset” (i.e., prematurely closing the current TCP connection)
- FIN packet stands for “finishing the connection”. It may be determined that the connection closed normally if the ACK (acknowledged) sequence number coincides with the last ACK sequence number sent by the server (because all of the packets sent from the server are acknowledged by the client). However, if the ACK sequence number is less than the maximum sequence number sent from the server (as in situation #2 above), then it may be determined that the connection was aborted prematurely.
- performance data for such aborted access may be used in determining whether it is reflective of poor server QoS. For example, the client-perceived response time for a requested web page prior to the access of such web page being aborted may be determined. And, if such response time is greater than a defined threshold, it may be determined that the aborted page access is likely attributable to poor server QoS.
- a target client-perceived end-to-end time of less than six seconds for their web pages. That is, website providers typically like to provide their requested web pages to a client in less than six seconds from the time the client requests the page.
- the defined threshold against which the response time may be compared to determine whether an aborted page access is attributable to poor server QoS may be implemented as six seconds.
- any other suitable threshold above which a server's response time may be considered as poor may be used in relating aborted client accesses of server information (e.g., a web page) to poor server QoS.
- the performance data for aborted client web page accesses enables a determination of latency in the response time that is attributable to the server (e.g., server processing time) and the latency that is attributable to the network due, for example, to network congestion. That is, performance data for a client's access of a web page provided by a server may be utilized to determine latency that is attributable to server-related performance issues, such as high server processing time due, for example, to server overload (e.g., too many processes running on the server), as well as latency that is attributable to network-related performance issues (e.g., high network transfer time for a web page due, for example, to network congestion and/or low bandwidth available to a client).
- server-related performance issues such as high server processing time due, for example, to server overload (e.g., too many processes running on the server), as well as latency that is attributable to network-related performance issues (e.g., high network transfer time for a web page due, for example,
- a preferred embodiment is operable to determine whether an aborted client access of server information had a high response time that is attributable to the server's performance, as opposed to the network's performance. Therefore, a preferred embodiment may determine whether such aborted access is indicative of poor QoS provided by the server. For instance, if an aborted client access of a web page had a high response time that is mostly attributable to network latency, then such aborted access may be determined to not be related to poor server QoS. However, if an aborted web page access had a high response time that is mostly attributable to server latency, then such aborted access may be determined to be related to poor server QoS.
- FIG. 5 shows an example operational flow for implementing operational blocks 304 and 305 of FIG. 3 for determining performance data for an aborted web page access and using such performance data to determine whether the aborted access is related to poor server QoS.
- performance data may, in certain embodiments, be determined for web page accesses in the manner further described in U.S. patent application Ser. No.
- the browser when a client clicks a hypertext link to retrieve an HTML file, the browser first establishes a TCP connection with the web server by sending a SYN packet. If the server is ready to process the request, it accepts the connection by acknowledgment of the client's SYN. The exchange of the SYN packets is the beginning of a connection. Then, the browser begins to send an HTTP request for the HTML file through the TCP connection. For each request (related to the web page), we are concerned about the timestamps for the first byte and the last byte of the request since they delimit the request transfer time and the beginning of server processing. Similarly, we are also concerned about the timestamps of the beginning and the end of the HTTP response. Besides, the timestamp of the acknowledgment packet for the last byte of the response explicitly indicates that the browser has received the entire response.
- HTTP 1.0 and later version HTTP 1.1 introduce the concept of persistent connections and pipelining. See R T. Fielding, J. Gettys, J. Mogul, H. Nielsen, and T. Berners-Lee, “Hypertext Transfer Protocol—HTTP/1.1”, RFC 2068, IETF, January 1997 (available at http://www.w3.org/Protocols/rfc2068/rfc2068). Persistent connections enable reuse of a single TCP connection for multiple object retrievals from the same IP address (typically embedded objects of a web page). Pipelining allows a client to make a series of requests on a persistent connection without waiting for the previous response to complete (the server, however, returns the responses in the same order as the requests are sent).
- conn 1 , . . . , conn N e.g., number of distinct TCP connections
- pipelining groups, if any, comprising transactions of each connection of a common client access of a server are determined. In a preferred embodiment, we consider the requests
- the main latency components are determined for each pipelining group. That is, for each of the pipelining groups, three portions of response time are defined in a preferred embodiment: 1) total response time (Total), 2) network-related portion (Network), and 3) lower-bound estimate of the server processing time (Server).
- the pipelining groups consist of one request only.
- the computed server time represents precisely the server processing time for a given request-response pair (or transaction).
- server processing time only the server time that is explicitly exposed on the connection.
- the “real” server processing time might be larger than the computed server time because it can partially overlap with the network transfer time, and it is difficult to estimate the exact server processing time from the packet-level information.
- connection setup time for each connection is determined.
- the client-perceived end-to-end time for retrieving a web page may include a certain amount of setup time for establishing the TCP connection with the server.
- connection conn k is a newly established connection to retrieve a web page, we observe additional connection setup time:
- the total time, as well as the portion of the total time that is attributable to server latency and the portion that is attributable to network latency, is computed, in operational block 503 .
- the latency breakdown for a given connection conn k is defined as:
- the response time is determined for a given page “P” that is accessed via client connection(s) under consideration, which may comprise multiple concurrent connections).
- the portion of the response time that is attributable to server latency and the portion that is attributable to network latency are determined.
- the latencies for a given page P may be defined in a preferred embodiment as:
- CumNetwork(P) and CumServer(P) above give the sum of all the network-related and server processing portions of the response time over all connections used to retrieve the web page.
- the response time may be evaluated to determine whether an aborted web page access is likely attributable to poor server QoS.
- a determination is made as to whether the aborted web page access under evaluation has a total response time that is greater than a defined threshold (e.g., six seconds). For instance, let X EtE be a defined end-to-end time threshold of responses: i.e., if the download time for a web page (with embedded images) is greater than X EtE , then it is considered to be unsatisfactory due to high response time.
- a defined threshold e.g. six seconds
- the subset ⁇ bad of all aborted pages II are the pages that might be reflective of poor server QoS.
- the rest of the pages from ⁇ are determined to be aborted due to client browsing patterns rather than poor server QoS experienced by the client.
- the high response time is due to network related performance problems (e.g., high network latency due, for example, to network congestion). If, on the other hand, PageServiceRatio(P) ⁇ 1, then it is determined in a preferred embodiment that the high response time is due to server related performance problems (e.g., high server latency due, for example, to server overload). If it is determined in operational block 507 that the high response time is due to server related performance problems, then it is determined in block 508 that the aborted web page access under evaluation is attributable to poor server QoS.
- network related performance problems e.g., high network latency due, for example, to network congestion.
- server related performance problems e.g., high server latency due, for example, to server overload. If it is determined in operational block 507 that the high response time is due to server related performance problems, then it is determined in block 508 that the aborted web page access under evaluation is attributable to poor server QoS.
- FIG. 6 shows the number of all requests and the number of aborted requests to the “index.html” page over time (on an hourly scale) for this study.
- FIG. 7 shows the average end-to-end response time observed by the clients when downloading the “index.html” page and the average end-to-end response time observed by the clients of the aborted accesses to “index.html” on the hourly scale for this study.
- FIG. 8 shows cumulative distribution of all accesses to “index.html” and aborted accesses to “index.html” sorted by their end-to-end response time in increasing order.
- the horizontal line on the graph shows the threshold of 6 seconds that corresponds to a generally acceptable end-to-end response time for a web page download.
- FIG. 8 shows that 68% of the aborted accesses in this study have an end-to-end response time below 6 seconds. Thus, only 32% of all the aborted accesses observe high end-to-end response time. That is, in this study, only 32% of the aborted web page accesses are potentially related to poor server QoS because 68% of the aborted accesses had an acceptable response time (below the threshold of 6 seconds).
- embodiments of the present invention provide a technique for relating aborted client accesses of server information (e.g., a web page) to the server's QoS to more accurately analyze the true client-perceived QoS of a server.
- server information e.g., a web page
- various elements of the present invention are in essence the software code defining the operations of such various elements.
- the executable instructions or software code may be obtained from a readable medium (e.g., a hard drive media, optical media, EPROM, EEPROM, tape media, cartridge media, flash memory, ROM, memory stick, and/or the like) or communicated via a data signal from a communication medium (e.g., the Internet).
- readable media can include any medium that can store or transfer information.
- FIG. 9 illustrates an example computer system 900 adapted according to embodiments of the present invention.
- computer system 900 is a web server on which computer executable code may be implemented for relating aborted client accesses of server information to the server's QoS.
- Central processing unit (CPU) 901 is coupled to system bus 902 .
- CPU 901 may be any general purpose CPU. Suitable processors include without limitation INTEL's PENTIUM® 4 processor, for example. However, the present invention is not restricted by the architecture of CPU 901 as long as CPU 901 supports the inventive operations as described herein.
- CPU 901 may execute the various logical instructions according to embodiments of the present invention. For example, CPU 901 may execute machine-level instructions according to the exemplary operational flows described above in conjunction with FIGS. 3 and 5 .
- Computer system 900 also preferably includes random access memory (RAM) 903 , which may be SRAM, DRAM, SDRAM, or the like. Computer system 900 may utilize RAM 903 to store the Network Trace 401 A, Transaction Log 402 A, and/or Web Page Session Log 403 A, as examples. Computer system 900 preferably includes read-only memory (ROM) 904 which may be PROM, EPROM, EEPROM, or the like. RAM 903 and ROM 904 hold user and system data and programs as is well known in the art.
- RAM random access memory
- ROM read-only memory
- Computer system 900 also preferably includes input/output (I/O) adapter 905 , communications adapter 911 , user interface adapter 908 , and display adapter 909 .
- I/O adapter 905 and/or user interface adapter 908 may, in certain embodiments, enable a user to interact with computer system 900 in order to input information (e.g., for specifying a response time threshold used for determining whether an aborted client access of server information is related to poor server QoS).
- I/O adapter 905 preferably connects to storage device(s) 906 , such as one or more of hard drive, compact disc (CD) drive, floppy disk drive, tape drive, etc. to computer system 900 .
- the storage devices may be utilized when RAM 903 is insufficient for the memory requirements associated with storing data for reconstructing web page accesses.
- Communications adapter 911 is preferably adapted to couple computer system 900 to network 103 .
- User interface adapter 908 couples user input devices, such as keyboard 913 , pointing device 907 , and microphone 914 and/or output devices, such as speaker(s) 915 to computer system 900 .
- Display adapter 909 is driven by CPU 901 to control the display on display device 910 .
- the present invention is not limited to the architecture of system 900 .
- any suitable processor-based device may be utilized, including without limitation personal computers, laptop computers, computer workstations, and multi-processor servers.
- embodiments of the present invention may be implemented on application specific integrated circuits (ASICs) or very large scale integrated (VLSI) circuits.
- ASICs application specific integrated circuits
- VLSI very large scale integrated circuits
Abstract
Description
TABLE 1 | |
Field | Value |
URL | The URL of the transaction. |
Referer | The value of the header field Referer, if it |
exists. | |
Content Type | The value of the header field Content-Type in |
the responses. | |
Flow ID | A unique identifier to specify the TCP |
connection of this transaction. | |
Source IP | The client's IP address. |
Request Length | The number of bytes of the HTTP request. |
Response Length | The number of bytes of the HTTP response. |
Content Length | The number of bytes of HTTP response body. |
Request SYN timestamp | The timestamp of the SYN packet from the |
client. | |
Request Start timestamp | The timestamp for receipt of the first byte of |
the HTTP request. | |
Request End timestamp | The timestamp for receipt of the last byte of the |
HTTP request. | |
Start of Response | The timestamp when the first byte of response |
is sent by the server to the client | |
End of Response | The time stamp when the last byte of response |
is sent by the server to the client | |
ACK of Response | The ACK packet from the client for the last |
Timestamp | byte of the HTTP response. |
Response Status | The HTTP response status code. |
Via Field | Identification of whether the HTTP field Via is |
set. | |
Aborted | Identification of whether the TCP connection |
aborted. | |
Resent Request Packets | The number of packets resent by the client. |
Resent Response Packet | The number of packets resent by the server. |
-
- Request: Get/index.html HTTP/1.0
- Host: www.hpl.hp.com
- Response: HTTP/1.0 200 0K
- Content-Type: text/html
- Request: Get/index.html HTTP/1.0
-
- Request: Get/imgl.jpg HTTP/1.0
- Host: www.hpl.hp.com
- Referer: http://www.hpl.hp.com/index.html
- Response: HTTP/1.0 200 OK
- Content-Type: image/jpeg
- Request: Get/imgl.jpg HTTP/1.0
-
- tsyn(conn): time when the first SYN packet from the client is received by the server for establishing the connection conn;
- treq start(r): time when the first byte of the request r is received by the server;
- treq end(r): time when the last byte of the request r is received by the server;
- tresp start(r): time when the first byte of the response for r is sent by the server; and
- tresp end(r): time when the last byte of the response for r is sent by the server.
-
- N: the number of distinct network connections, conn1, . . . , connN (e.g., number of distinct TCP connections) used to retrieve the objects in the web page P (see e.g.,
operational block 500 ofFIG. 5 ); and
- N: the number of distinct network connections, conn1, . . . , connN (e.g., number of distinct TCP connections) used to retrieve the objects in the web page P (see e.g.,
the requests for the objects retrieved through the connection connk (k=1, . . . , N), and ordered according to the time when they were received, i.e.,
to belong to the same pipelining group (denoted as
if for any j such that
we define the maximum pipelining groups in such a way that they do not intersect, e.g.,
then
Server(PipeGr1)=Total(PipeGr1)−Network(PipeGr1).
Claims (40)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/146,988 US8392499B2 (en) | 2002-05-16 | 2002-05-16 | System and method for relating aborted client accesses of data to quality of service provided by a server in a client-server network |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/146,988 US8392499B2 (en) | 2002-05-16 | 2002-05-16 | System and method for relating aborted client accesses of data to quality of service provided by a server in a client-server network |
Publications (2)
Publication Number | Publication Date |
---|---|
US20050076111A1 US20050076111A1 (en) | 2005-04-07 |
US8392499B2 true US8392499B2 (en) | 2013-03-05 |
Family
ID=34392818
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/146,988 Expired - Fee Related US8392499B2 (en) | 2002-05-16 | 2002-05-16 | System and method for relating aborted client accesses of data to quality of service provided by a server in a client-server network |
Country Status (1)
Country | Link |
---|---|
US (1) | US8392499B2 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9009296B1 (en) * | 2009-08-07 | 2015-04-14 | Google Inc. | System and method of determining latency |
US10200435B2 (en) * | 2015-09-22 | 2019-02-05 | Pathsolutions, Inc. | Network communications service quality monitor |
US11461794B2 (en) | 2019-02-15 | 2022-10-04 | Yandex Europe Ag | Method and system for verifying accuracy of information associated with digital item |
Families Citing this family (24)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7490148B1 (en) | 2002-05-30 | 2009-02-10 | At&T Intellectual Property I, L.P. | Completion performance analysis for internet services |
US8266270B1 (en) | 2002-07-16 | 2012-09-11 | At&T Intellectual Property I, L.P. | Delivery performance analysis for internet services |
US7752293B1 (en) * | 2002-07-30 | 2010-07-06 | Cisco Technology, Inc. | Command processing in a telecommunications network |
US20040111510A1 (en) * | 2002-12-06 | 2004-06-10 | Shahid Shoaib | Method of dynamically switching message logging schemes to improve system performance |
DE10330282B4 (en) * | 2003-07-04 | 2006-06-01 | Siemens Ag | Device and method for user-side processing of electronic messages with file attachments |
US20050256677A1 (en) * | 2004-05-12 | 2005-11-17 | Hayes Dennis P | System and method for measuring the performance of a data processing system |
US8046357B2 (en) * | 2005-11-07 | 2011-10-25 | Iac Search & Media, Inc. | Sampling internet user traffic to improve search results |
US7917446B2 (en) * | 2007-10-31 | 2011-03-29 | American Express Travel Related Services Company, Inc. | Latency locator |
TW201010358A (en) * | 2008-08-19 | 2010-03-01 | Arcadyan Technology Corp | Method of automatic reconnecting web interface for customer premises equipment |
US8122124B1 (en) * | 2008-09-29 | 2012-02-21 | Amazon Technologies, Inc. | Monitoring performance and operation of data exchanges |
US7917618B1 (en) | 2009-03-24 | 2011-03-29 | Amazon Technologies, Inc. | Monitoring web site content |
US8856027B2 (en) * | 2009-10-07 | 2014-10-07 | Yahoo! Inc. | System and method for slow ad detection |
US8392558B1 (en) * | 2011-03-22 | 2013-03-05 | Amazon Technologies, Inc. | System and method for determining overload state for service requests |
US8972568B2 (en) * | 2012-02-21 | 2015-03-03 | Telefonaktiebolaget L M Ericsson (Publ) | Quantifying user quality of experience by passive monitoring |
US8935581B2 (en) | 2012-04-19 | 2015-01-13 | Netflix, Inc. | Upstream fault detection |
US20140379891A1 (en) * | 2013-06-20 | 2014-12-25 | Telefonaktiebolaget L M Ericsson (Publ) | Methods and Apparatuses to Identify User Dissatisfaction from Early Cancelation |
US10084730B2 (en) | 2014-10-21 | 2018-09-25 | Unify Gmbh & Co. Kg | Apparatus and method for quickly sending messages |
US9769248B1 (en) | 2014-12-16 | 2017-09-19 | Amazon Technologies, Inc. | Performance-based content delivery |
US10225365B1 (en) | 2014-12-19 | 2019-03-05 | Amazon Technologies, Inc. | Machine learning based content delivery |
US10311371B1 (en) | 2014-12-19 | 2019-06-04 | Amazon Technologies, Inc. | Machine learning based content delivery |
US10311372B1 (en) | 2014-12-19 | 2019-06-04 | Amazon Technologies, Inc. | Machine learning based content delivery |
WO2019023931A1 (en) * | 2017-08-01 | 2019-02-07 | 深圳市益廷科技有限公司 | Method for monitoring health condition of guest in hotel |
US11481362B2 (en) * | 2017-11-13 | 2022-10-25 | Cisco Technology, Inc. | Using persistent memory to enable restartability of bulk load transactions in cloud databases |
US11588843B1 (en) * | 2022-04-08 | 2023-02-21 | Morgan Stanley Services Group Inc. | Multi-level log analysis to detect software use anomalies |
Citations (35)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5819301A (en) | 1995-09-25 | 1998-10-06 | Adobe Systems Incorporated | Method and apparatus for reading multi-page electronic documents |
US6272598B1 (en) | 1999-03-22 | 2001-08-07 | Hewlett-Packard Company | Web cache performance by applying different replacement policies to the web cache |
US20010027483A1 (en) | 1997-10-31 | 2001-10-04 | Gupta Puneet Kumar | Method and apparatus for use of an application state storage system in interacting with on -line services |
US6330602B1 (en) * | 1997-04-14 | 2001-12-11 | Nortel Networks Limited | Scaleable web server and method of efficiently managing multiple servers |
US6338059B1 (en) | 1998-12-17 | 2002-01-08 | International Business Machines Corporation | Hyperlinked search interface for distributed database |
US20020032854A1 (en) | 2000-09-12 | 2002-03-14 | Chen Eric Yi-Hua | Distributed denial of service attack defense method and device |
US20020046284A1 (en) | 2000-08-24 | 2002-04-18 | Brabson Roy Frank | Methods, systems and computer program products for providing transactional quality of service |
US6377944B1 (en) | 1998-12-11 | 2002-04-23 | Avaya Technology Corp. | Web response unit including computer network based communication |
US6389462B1 (en) | 1998-12-16 | 2002-05-14 | Lucent Technologies Inc. | Method and apparatus for transparently directing requests for web objects to proxy caches |
US20020120727A1 (en) * | 2000-12-21 | 2002-08-29 | Robert Curley | Method and apparatus for providing measurement, and utilization of, network latency in transaction-based protocols |
US6484143B1 (en) | 1999-11-22 | 2002-11-19 | Speedera Networks, Inc. | User device and system for traffic management and content distribution over a world wide area network |
US20030005122A1 (en) | 2001-06-27 | 2003-01-02 | International Business Machines Corporation | In-kernel content-aware service differentiation |
US20030028674A1 (en) | 2001-07-30 | 2003-02-06 | International Business Machines Corporation | System and method for IP packet filtering based on non-IP packet traffic attributes |
US20030028662A1 (en) | 2001-07-17 | 2003-02-06 | Rowley Bevan S | Method of reconstructing network communications |
US6549941B1 (en) | 1999-11-22 | 2003-04-15 | Alexa Internet | Software system and methods for resubmitting form data to related web sites |
US6560639B1 (en) | 1998-02-13 | 2003-05-06 | 3565 Acquisition Corporation | System for web content management based on server-side application |
US20030110394A1 (en) | 2000-05-17 | 2003-06-12 | Sharp Clifford F. | System and method for detecting and eliminating IP spoofing in a data transmission network |
US6594260B1 (en) | 1999-09-03 | 2003-07-15 | Cisco Technology, Inc. | Content routing |
US6636972B1 (en) | 1998-09-01 | 2003-10-21 | Networks Associates Technology, Inc. | System and method for building an executable script for performing a network security audit |
US20030217117A1 (en) | 1998-02-13 | 2003-11-20 | Noah Dan | Method and system for web management |
US20030221000A1 (en) | 2002-05-16 | 2003-11-27 | Ludmila Cherkasova | System and method for measuring web service performance using captured network packets |
US6675218B1 (en) | 1998-08-14 | 2004-01-06 | 3Com Corporation | System for user-space network packet modification |
US6728885B1 (en) | 1998-10-09 | 2004-04-27 | Networks Associates Technology, Inc. | System and method for network access control using adaptive proxies |
US6763342B1 (en) | 1998-07-21 | 2004-07-13 | Sentar, Inc. | System and method for facilitating interaction with information stored at a web site |
US6807156B1 (en) * | 2000-11-07 | 2004-10-19 | Telefonaktiebolaget Lm Ericsson (Publ) | Scalable real-time quality of service monitoring and analysis of service dependent subscriber satisfaction in IP networks |
US6871284B2 (en) | 2000-01-07 | 2005-03-22 | Securify, Inc. | Credential/condition assertion verification optimization |
US6901553B1 (en) | 1999-03-30 | 2005-05-31 | Fuji Xerox Co., Ltd. | Apparatus and method for providing intrinsic access space to user in hypertext space |
US6901051B1 (en) * | 1999-11-15 | 2005-05-31 | Fujitsu Limited | Server-based network performance metrics generation system and method |
US6934740B1 (en) | 2000-09-19 | 2005-08-23 | 3Com Corporation | Method and apparatus for sharing common data objects among multiple applications in a client device |
US6934761B1 (en) | 2000-02-25 | 2005-08-23 | Sun Microsystems, Inc. | User level web server cache control of in-kernel http cache |
US6938202B1 (en) | 1999-12-17 | 2005-08-30 | Canon Kabushiki Kaisha | System for retrieving and printing network documents |
US7246101B2 (en) | 2002-05-16 | 2007-07-17 | Hewlett-Packard Development Company, L.P. | Knowledge-based system and method for reconstructing client web page accesses from captured network packets |
US20080183664A1 (en) * | 2002-03-07 | 2008-07-31 | David Cancel | Presenting web site analytics associated with search results |
US7437451B2 (en) | 2002-05-16 | 2008-10-14 | Hewlett-Packard Development Company, L.P. | System and method for collecting desired information for network transactions at the kernel level |
US7487508B2 (en) | 2002-05-16 | 2009-02-03 | Hewlett-Packard Development Company, L.P. | System and method for reconstructing client web page accesses from captured network packets |
-
2002
- 2002-05-16 US US10/146,988 patent/US8392499B2/en not_active Expired - Fee Related
Patent Citations (36)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5819301A (en) | 1995-09-25 | 1998-10-06 | Adobe Systems Incorporated | Method and apparatus for reading multi-page electronic documents |
US6330602B1 (en) * | 1997-04-14 | 2001-12-11 | Nortel Networks Limited | Scaleable web server and method of efficiently managing multiple servers |
US6535913B2 (en) | 1997-10-31 | 2003-03-18 | Selectica, Inc. | Method and apparatus for use of an application state storage system in interacting with on-line services |
US20010027483A1 (en) | 1997-10-31 | 2001-10-04 | Gupta Puneet Kumar | Method and apparatus for use of an application state storage system in interacting with on -line services |
US6560639B1 (en) | 1998-02-13 | 2003-05-06 | 3565 Acquisition Corporation | System for web content management based on server-side application |
US20030217117A1 (en) | 1998-02-13 | 2003-11-20 | Noah Dan | Method and system for web management |
US6763342B1 (en) | 1998-07-21 | 2004-07-13 | Sentar, Inc. | System and method for facilitating interaction with information stored at a web site |
US6675218B1 (en) | 1998-08-14 | 2004-01-06 | 3Com Corporation | System for user-space network packet modification |
US6636972B1 (en) | 1998-09-01 | 2003-10-21 | Networks Associates Technology, Inc. | System and method for building an executable script for performing a network security audit |
US6728885B1 (en) | 1998-10-09 | 2004-04-27 | Networks Associates Technology, Inc. | System and method for network access control using adaptive proxies |
US6377944B1 (en) | 1998-12-11 | 2002-04-23 | Avaya Technology Corp. | Web response unit including computer network based communication |
US6389462B1 (en) | 1998-12-16 | 2002-05-14 | Lucent Technologies Inc. | Method and apparatus for transparently directing requests for web objects to proxy caches |
US6338059B1 (en) | 1998-12-17 | 2002-01-08 | International Business Machines Corporation | Hyperlinked search interface for distributed database |
US6272598B1 (en) | 1999-03-22 | 2001-08-07 | Hewlett-Packard Company | Web cache performance by applying different replacement policies to the web cache |
US6901553B1 (en) | 1999-03-30 | 2005-05-31 | Fuji Xerox Co., Ltd. | Apparatus and method for providing intrinsic access space to user in hypertext space |
US6594260B1 (en) | 1999-09-03 | 2003-07-15 | Cisco Technology, Inc. | Content routing |
US6901051B1 (en) * | 1999-11-15 | 2005-05-31 | Fujitsu Limited | Server-based network performance metrics generation system and method |
US6484143B1 (en) | 1999-11-22 | 2002-11-19 | Speedera Networks, Inc. | User device and system for traffic management and content distribution over a world wide area network |
US6549941B1 (en) | 1999-11-22 | 2003-04-15 | Alexa Internet | Software system and methods for resubmitting form data to related web sites |
US6938202B1 (en) | 1999-12-17 | 2005-08-30 | Canon Kabushiki Kaisha | System for retrieving and printing network documents |
US6871284B2 (en) | 2000-01-07 | 2005-03-22 | Securify, Inc. | Credential/condition assertion verification optimization |
US6934761B1 (en) | 2000-02-25 | 2005-08-23 | Sun Microsystems, Inc. | User level web server cache control of in-kernel http cache |
US20030110394A1 (en) | 2000-05-17 | 2003-06-12 | Sharp Clifford F. | System and method for detecting and eliminating IP spoofing in a data transmission network |
US20020046284A1 (en) | 2000-08-24 | 2002-04-18 | Brabson Roy Frank | Methods, systems and computer program products for providing transactional quality of service |
US20020032854A1 (en) | 2000-09-12 | 2002-03-14 | Chen Eric Yi-Hua | Distributed denial of service attack defense method and device |
US6934740B1 (en) | 2000-09-19 | 2005-08-23 | 3Com Corporation | Method and apparatus for sharing common data objects among multiple applications in a client device |
US6807156B1 (en) * | 2000-11-07 | 2004-10-19 | Telefonaktiebolaget Lm Ericsson (Publ) | Scalable real-time quality of service monitoring and analysis of service dependent subscriber satisfaction in IP networks |
US20020120727A1 (en) * | 2000-12-21 | 2002-08-29 | Robert Curley | Method and apparatus for providing measurement, and utilization of, network latency in transaction-based protocols |
US20030005122A1 (en) | 2001-06-27 | 2003-01-02 | International Business Machines Corporation | In-kernel content-aware service differentiation |
US20030028662A1 (en) | 2001-07-17 | 2003-02-06 | Rowley Bevan S | Method of reconstructing network communications |
US20030028674A1 (en) | 2001-07-30 | 2003-02-06 | International Business Machines Corporation | System and method for IP packet filtering based on non-IP packet traffic attributes |
US20080183664A1 (en) * | 2002-03-07 | 2008-07-31 | David Cancel | Presenting web site analytics associated with search results |
US20030221000A1 (en) | 2002-05-16 | 2003-11-27 | Ludmila Cherkasova | System and method for measuring web service performance using captured network packets |
US7246101B2 (en) | 2002-05-16 | 2007-07-17 | Hewlett-Packard Development Company, L.P. | Knowledge-based system and method for reconstructing client web page accesses from captured network packets |
US7437451B2 (en) | 2002-05-16 | 2008-10-14 | Hewlett-Packard Development Company, L.P. | System and method for collecting desired information for network transactions at the kernel level |
US7487508B2 (en) | 2002-05-16 | 2009-02-03 | Hewlett-Packard Development Company, L.P. | System and method for reconstructing client web page accesses from captured network packets |
Non-Patent Citations (21)
Title |
---|
"Candle Corporation eBusiness"; printed from Website http://www.candle.com-10 pages. |
"Cisco DistributedDirector"; printed from Website http//www.cisco.com-20 pages. |
"IBM Corporation, Tivoli Web Management Solutions"; printed from Website http://www.tivoli.com-5 pages. |
"Javaserver Pages White Paper"; printed from Website http://java.sun.com-8 pages. |
"JavaServlet Technology"; printed from Website http://java.sun.com-14 pages. |
"Keynote Systems, Inc."; printed from Website http://www.keynote.com-4 pages. |
F. Donelson Smith et al., "What TCP/IP Protocol Headers Can Tell Us About the Web", Proceedings of ACM Sigmetrics 2001/Performance 2001; Jun. 2001; 12 pages. |
Feldmann, Anja, "BLT: Bi-Layer Tracing of HTTP and TCP/IP", AT&T Labs-Research, Florham Park, NJ,-12 pages. |
Krishnamurthy, Balachander, et al.; "Web Protocols and Practice: HTTP/1.1, Networking Protocols, Caching, and Traffic Measurement", pp. 511-522, Addison Wesley, 2001. |
Mark Stemm et al., "A Network Measurement Architecture for Adaptive Applications", INFOCOM 2000. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings. IEEE; Mar. 2000; 10 pages. |
NetMechanic, Inc.; printed from Website http://www.netemechanics.com-2 pages. |
Porivo Technologies, Inc.; printed from Website http://www.porivo.com-5 pages. |
Rajamony, Ramakrishnan et al., Measuring Client-Perceived Response Times on the WWW; proceedings of the Third USENIX Symposium on Internet Technologies and Systems, Mar. 2001-12 pages. |
Ramakrishnan Rajamony et al.; "Measuring Client-Perceived Response Times on the WWW"; proceedings of the Third USENIX Symposium on Internet Technologies and Systems; Mar. 2001; 12 pages. |
RFC2616; printed from Internet RFC/STD/FYI/BCO Archives. |
Seshan, Srinivasan, et al., "SPAND: Shared Passive Network Performance Discovery", USENIX Symposium on Internet Technologies and Systems, 1997, 6 pages. |
Smith, F. Donelson, et al., "What TCP/IP Protocol Headers Can Tell Us About the Web", Proceedings of ACM Sigmetrics 2001//Performance 2001, Jun. 2001-12 pages. |
Software Research, Inc.; printed from Website http://www.soft.com-2 pages. |
Srinivasan Seshan et al., "SPAND: Shared Passive Network Performance Discovery"; USENIX Symposium on Internet Technology and Systems; 1997; 13 pages. |
Stemm, Mark, et al., "A Network Measurement Architecture for Adaptice Applications", USENIX Symposium on Internet Technologies and Systems, 1997-10 pages. |
TCPDUMP, printed from Website http://www.tcpdump.org-3 pages. |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9009296B1 (en) * | 2009-08-07 | 2015-04-14 | Google Inc. | System and method of determining latency |
US9444711B1 (en) | 2009-08-07 | 2016-09-13 | Google Inc. | System and method of determining latency |
US9954970B1 (en) | 2009-08-07 | 2018-04-24 | Google Llc | System and method of determining latency |
US10200435B2 (en) * | 2015-09-22 | 2019-02-05 | Pathsolutions, Inc. | Network communications service quality monitor |
US11461794B2 (en) | 2019-02-15 | 2022-10-04 | Yandex Europe Ag | Method and system for verifying accuracy of information associated with digital item |
Also Published As
Publication number | Publication date |
---|---|
US20050076111A1 (en) | 2005-04-07 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8392499B2 (en) | System and method for relating aborted client accesses of data to quality of service provided by a server in a client-server network | |
US20030221000A1 (en) | System and method for measuring web service performance using captured network packets | |
US7437451B2 (en) | System and method for collecting desired information for network transactions at the kernel level | |
US7487508B2 (en) | System and method for reconstructing client web page accesses from captured network packets | |
US7246101B2 (en) | Knowledge-based system and method for reconstructing client web page accesses from captured network packets | |
US6411998B1 (en) | World wide web internet delay monitor | |
JP3167975B2 (en) | World Wide Web End User Response Time Recording Method | |
Liu et al. | Traffic model and performance evaluation of web servers | |
US5931912A (en) | Traversal path-based approach to understanding user-oriented hypertext object usage | |
US7933988B2 (en) | Method and system for monitoring performance of a client-server architecture | |
US20030046383A1 (en) | Method and system for measuring network performance from a server | |
Cherkasova et al. | Measuring and characterizing end-to-end internet service performance | |
US8572100B2 (en) | Method and system for recording search trails across one or more search engines in a communications network | |
US20030046343A1 (en) | Method for improving web performance by adapting servers based on client cluster characterization | |
US20040088408A1 (en) | Methods and systems for routing requests at a network switch | |
US11734367B2 (en) | Direct data center request for proxy web scraping | |
Fu et al. | EtE: Passive End-to-End Internet Service Performance Monitoring. | |
Casilari et al. | Modeling of HTTP traffic | |
Krishnamurthy et al. | Improving web performance by client characterization driven server adaptation | |
EP1026608A2 (en) | Method and apparatus for logging web user activity using client-side support | |
Wei et al. | Measuring client-perceived pageview response time of internet services | |
US20230018983A1 (en) | Traffic counting for proxy web scraping | |
Darst et al. | Measurement and management of internet services | |
EP4227829A1 (en) | Web scraping through use of proxies, and applications thereof | |
Fu et al. | Measuring End-to-End Internet Service Performance: Response Time, Caching Efficiency and QoS |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: HEWLETT-PACKARD COMPANY, COLORADO Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHERKASOVA, LUDMILA;FU, YUN;TANG, WESTING;REEL/FRAME:013418/0863 Effective date: 20020605 |
|
AS | Assignment |
Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., COLORAD Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD COMPANY;REEL/FRAME:013776/0928 Effective date: 20030131 Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.,COLORADO Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD COMPANY;REEL/FRAME:013776/0928 Effective date: 20030131 |
|
CC | Certificate of correction | ||
AS | Assignment |
Owner name: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, TEXAS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.;REEL/FRAME:037079/0001 Effective date: 20151027 |
|
REMI | Maintenance fee reminder mailed | ||
LAPS | Lapse for failure to pay maintenance fees | ||
STCH | Information on status: patent discontinuation |
Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362 |
|
FP | Lapsed due to failure to pay maintenance fee |
Effective date: 20170305 |